Ransomware: the mechanics of encryption

February 25, 2025 · 1 min read · #malware #ransomware #crypto

Ransomware encrypts the victim's files and demands a ransom for the key. The cryptography is designed so only the attacker can decrypt.

The hybrid scheme

Encrypting gigabytes with RSA would be far too slow, so: each file (or the whole volume) is encrypted with AES (fast); the AES key is then encrypted with the attacker's RSA public key. Without the private key (which the attacker keeps), the AES key stays unrecoverable.

per file:  key = random(); AES(file, key)
           store RSA_encrypt(pub, key) next to the file

The modern trimmings

Before encrypting: delete Volume Shadow Copies (vssadmin delete shadows), disable backups, and exfiltrate data for double extortion (pay or we publish). Often preceded by lateral movement to hit the whole network.

Defence

Offline/immutable, tested backups (the number-one defence), segmentation, MFA and patching to block entry, EDR for execution, monitoring of shadow-copy deletion and mass exfiltration.

« back to home